This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: do not remove elements if set backend implements .abort
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-do-not-remove-elements-if-set-ba.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 5134a5b5531b39ff0a1cc717f8397b1f2ec35970
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed Oct 4 13:12:58 2023 +0200
netfilter: nf_tables: do not remove elements if set backend implements .abort
[ Upstream commit ebd032fa881882fef2acb9da1bbde48d8233241d ]
pipapo set backend maintains two copies of the datastructure, removing
the elements from the copy that is going to be discarded slows down
the abort path significantly, from several minutes to few seconds after
this patch.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e43d9508e7a9c..0d48d2e27a1ad 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10336,7 +10336,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
break;
}
te = (struct nft_trans_elem *)trans->data;
- nft_setelem_remove(net, te->set, &te->elem);
+ if (!te->set->ops->abort ||
+ nft_setelem_is_catchall(te->set, &te->elem))
+ nft_setelem_remove(net, te->set, &te->elem);
+
if (!nft_setelem_is_catchall(te->set, &te->elem))
atomic_dec(&te->set->nelems);
